feat: support shared Windows Gen2 images

.pipelines/.vsts-vhd-builder-pr-windows.yaml

@@ -72,9 +72,9 @@ stages:
       useOverrides: False
       enableBackfillCleanup: True
       buildVmSize: Standard_D16ds_v5
-      # 2022 gen1 is the default, so build that for PRs
+      # Keep the default Gen1 image and cover both security modes on Gen2.
       build2022containerd: True
-      build2022containerdgen2: False
+      build2022containerdgen2: True
       # 2025 gen2 is the default, so build that for PRs
       build2025: False
       build2025gen2: True

.pipelines/templates/.build-and-test-windows-vhd-template.yaml

@@ -36,10 +36,6 @@ parameters:
     type: boolean
     displayName: Enable Trusted Launch on the SIG image definition
     default: False
-  - name: trustedLaunchSupported
-    type: boolean
-    displayName: Determines if the image is capable of supporting Trusted Launch
-    default: False
   - name: skipExtensionCheck
     displayName: Skip Extension Check
     type: boolean
@@ -91,7 +87,7 @@ stages:
               hyperVGeneration: ${{ parameters.hyperVGeneration }}
               architecture: ${{ parameters.architecture }}
               enableTrustedLaunch: ${{ parameters.enableTrustedLaunch }}
-              trustedLaunchSupported: ${{ parameters.trustedLaunchSupported }}
+              trustedLaunchSupported: ${{ eq(parameters.hyperVGeneration, 'V2') }}
               buildVmSize: ${{ parameters.buildVmSize }}
               build: ${{ parameters.build }}
               vhddebug: ${{ parameters.vhddebug }}

.pipelines/templates/.build-and-test-windows-vhds-template.yaml

@@ -174,9 +174,8 @@ stages:
       windowsSku: 2025-gen2-tl
       hyperVGeneration: V2
       architecture: X86_64
-      # TODO: replace enableTrustedLaunch with trustedLaunchSupported when / as able - by default we shouldn't need to build dedicated trusted launch images
+      # TODO: retire the dedicated image after Trusted Launch moves to the shared Gen2 image.
       enableTrustedLaunch: True
-      trustedLaunchSupported: True
       buildVmSize: ${{ parameters.buildVmSize }}
       build: ${{ parameters.build2025gen2tl }}
       vhddebug: ${{ parameters.vhddebug }}

e2e/README.md

@@ -108,6 +108,30 @@ alongside cluster preparation. Setup, validators, and cleanup batches share
 `scenario/concurrent.go`, which waits for every task without canceling peers on failure.
 Each caller decides whether an already-canceled context prevents its tasks from starting.
 
+## Shared Windows Gen2 images
+
+The ordinary WS2022 and WS2025 Gen2 images are published as `TrustedLaunchSupported`.
+Each has a separate scenario that enables Secure Boot and vTPM on the VMSS:
+
+| Image | Standard scenario | Trusted Launch scenario |
+| --- | --- | --- |
+| `windows-2022-containerd-gen2` | `Windows2022Gen2AzureNetwork` | `Windows2022Gen2_TrustedLaunch_SharedImage` |
+| `windows-2025-gen2` | `Windows2025Gen2` | `Windows2025Gen2_TrustedLaunch_SharedImage` |
+
+Separate nodes are needed because their VM security profiles differ. These direct
+image tests do not change AKS RP's OS eligibility checks.
+
+The builder reuses already-capable staging definitions without `startsAtVersion`
+without modifying them. Explicit boundaries must be valid and at or below the
+build version; new capability migrations still establish and verify a boundary.
+The VHD-build gate validates the actual build's image, not historical versions.
+Production publication and RP image-version admission remain separate checks.
+
+`Windows2025Gen2TrustedLaunch` continues to validate the dedicated
+`windows-2025-gen2-tl` image during the shared-image rollout.
+The shared-image scenarios run in both the Windows VHD-build gate, using that
+build's image, and the general Windows E2E job, using the main-tagged test image.
+
 ## VM size configuration
 
 Resource SKU catalogues are loaded once per location using the runner's single

e2e/scenario/scenario_win.go

@@ -140,6 +140,33 @@ var _ = Register(&Scenario{
 	},
 })
 
+var _ = Register(&Scenario{
+	Name:        "Windows2022Gen2_TrustedLaunch_SharedImage",
+	Description: "Windows Server 2022 Gen2 Trusted Launch (Secure Boot + vTPM)",
+	Config: Config{
+		Cluster: ClusterAzureNetwork,
+		VHD:     config.VHDWindows2022ContainerdGen2,
+		VMConfigMutator: func(vmss *armcompute.VirtualMachineScaleSet) {
+			vmss.Properties = addTrustedLaunchToVMSS(vmss.Properties)
+		},
+		BootstrapConfigMutator: EmptyBootstrapConfigMutator,
+		Validator: func(ctx context.Context, s *Scenario) error {
+			return errors.Join(
+				ValidateWindowsVersionFromWindowsSettings(ctx, s, "2022-containerd-gen2"),
+				ValidateWindowsProductName(ctx, s, "Windows Server 2022 Datacenter"),
+				ValidateWindowsDisplayVersion(ctx, s, "21H2"),
+				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote"),
+				ValidateKubeletArgs(ctx, s),
+				ValidateContainerdWindowsPriorityClass(ctx, s),
+				ValidateCiliumIsNotRunningWindows(ctx, s),
+				ValidateDotnetNotInstalledWindows(ctx, s),
+				ValidateWindowsSystemServicesRestartConfiguration(ctx, s),
+				ValidateCollectWindowsLogsScript(ctx, s),
+			)
+		},
+	},
+})
+
 var _ = Register(&Scenario{
 	Name:        "Windows2022Gen2AzureOverlayNetworkDualStack",
 	SkipReason:  "Dual stack tests are not working yet",
@@ -220,34 +247,45 @@ var _ = Register(&Scenario{
 	},
 })
 
-var _ = Register(&Scenario{
-	Name:        "Windows2025Gen2TrustedLaunch",
-	Description: "Windows Server 2025 Gen2 Trusted Launch (Secure Boot + vTPM)",
-	Config: Config{
-		Cluster: ClusterAzureNetwork,
-		VHD:     config.VHDWindows2025Gen2TL,
-		VMConfigMutator: func(vmss *armcompute.VirtualMachineScaleSet) {
-			vmss.Properties = addTrustedLaunchToVMSS(vmss.Properties)
-		},
-		BootstrapConfigMutatorWithError: func(_ context.Context, _ *Cluster, configuration *datamodel.NodeBootstrappingConfiguration) error {
-			return Windows2025BootstrapConfigMutator(configuration)
-		},
-		Validator: func(ctx context.Context, s *Scenario) error {
-			return errors.Join(
-				ValidateWindowsVersionFromWindowsSettings(ctx, s, "2025-gen2-tl"),
-				ValidateWindowsProductName(ctx, s, "Windows Server 2025 Datacenter"),
-				ValidateWindowsDisplayVersion(ctx, s, "24H2"),
-				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote"),
-				ValidateKubeletArgs(ctx, s),
-				ValidateContainerdWindowsPriorityClass(ctx, s),
-				ValidateCiliumIsNotRunningWindows(ctx, s),
-				ValidateDotnetNotInstalledWindows(ctx, s),
-				ValidateWindowsSystemServicesRestartConfiguration(ctx, s),
-				ValidateCollectWindowsLogsScript(ctx, s),
-			)
-		},
-	},
-})
+func init() {
+	for _, tc := range []struct {
+		name       string
+		vhd        *config.Image
+		windowsSKU string
+	}{
+		{"Windows2025Gen2TrustedLaunch", config.VHDWindows2025Gen2TL, "2025-gen2-tl"},
+		{"Windows2025Gen2_TrustedLaunch_SharedImage", config.VHDWindows2025Gen2, "2025-gen2"},
+	} {
+		Register(&Scenario{
+			Name:        tc.name,
+			Description: "Windows Server 2025 Gen2 Trusted Launch (Secure Boot + vTPM)",
+			Config: Config{
+				Cluster: ClusterAzureNetwork,
+				VHD:     tc.vhd,
+				VMConfigMutator: func(vmss *armcompute.VirtualMachineScaleSet) {
+					vmss.Properties = addTrustedLaunchToVMSS(vmss.Properties)
+				},
+				BootstrapConfigMutatorWithError: func(_ context.Context, _ *Cluster, configuration *datamodel.NodeBootstrappingConfiguration) error {
+					return Windows2025BootstrapConfigMutator(configuration)
+				},
+				Validator: func(ctx context.Context, s *Scenario) error {
+					return errors.Join(
+						ValidateWindowsVersionFromWindowsSettings(ctx, s, tc.windowsSKU),
+						ValidateWindowsProductName(ctx, s, "Windows Server 2025 Datacenter"),
+						ValidateWindowsDisplayVersion(ctx, s, "24H2"),
+						ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote"),
+						ValidateKubeletArgs(ctx, s),
+						ValidateContainerdWindowsPriorityClass(ctx, s),
+						ValidateCiliumIsNotRunningWindows(ctx, s),
+						ValidateDotnetNotInstalledWindows(ctx, s),
+						ValidateWindowsSystemServicesRestartConfiguration(ctx, s),
+						ValidateCollectWindowsLogsScript(ctx, s),
+					)
+				},
+			},
+		})
+	}
+}
 
 var _ = Register(&Scenario{
 	Name:        "Windows2025Gen2_WindowsCiliumNetworking",